feat(ci): configure cargo deny for workspace layer boundary enforcement

[josecelano]

Description

Install and configure cargo deny to programmatically enforce the workspace's layered architecture rules, preventing accidental dependency edges between layers from being introduced.

Closes #1925

Changes

• deny.toml (new): workspace root configuration with [bans] section using the wrappers mechanism to restrict which packages can depend on server-layer, protocol, and core crates
• .github/workflows/testing.yaml: added new layer-bans CI job that runs cargo deny check bans
• .github/workflows/copilot-setup-steps.yml: added Install cargo-deny step (setup workflow for Copilot agent VM infrastructure)
• contrib/dev-tools/git/hooks/pre-commit.sh: added cargo deny check bans as a pre-commit step (0.57s runtime)
• docs/packages.md: added "Layer Boundary Enforcement" section documenting forbidden edges, wrapper mechanism, known exceptions, and maintenance instructions
• packages/AGENTS.md: added step 7 in "Adding or Modifying a Package" referencing deny enforcement
• packages/udp-server/Cargo.toml: fixed wildcard path dependency (added missing version)
• packages/persistence-benchmark/Cargo.toml: fixed wildcard path dependency (added missing version)
• docs/issues/open/1925-...md: updated implementation tracking and verification results

Verification

• cargo deny check bans — ✅ (exit 0, zero errors)
• Forbidden edge test (core -> server) — ✅ detected as error[banned]
• cargo build --workspace — ✅
• linter all — ✅
• cargo test --doc --workspace — ✅
• Pre-commit hook — ✅ (all steps pass)

[Copilot]

Pull request overview

Adds automated enforcement of the workspace’s layered architecture by introducing cargo deny bans (via wrappers) and wiring the check into local and CI workflows, plus updating documentation and fixing internal dependency metadata needed to satisfy wildcard bans.

Changes:

• Added deny.toml with [bans] rules to prevent forbidden cross-layer dependency edges.
• Integrated cargo deny check bans into CI (testing.yaml) and the local pre-commit hook.
• Documented the enforcement mechanism and updated internal path dependencies to include explicit versions (to satisfy wildcard bans).

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
deny.toml	New cargo-deny bans configuration to enforce layer boundaries via wrappers.
.github/workflows/testing.yaml	Adds layer-bans job to run cargo deny check bans in CI.
.github/workflows/copilot-setup-steps.yml	Installs cargo-deny in the Copilot setup workflow so agent VMs can run the new checks.
contrib/dev-tools/git/hooks/pre-commit.sh	Adds a pre-commit step to run cargo deny check bans.
docs/packages.md	Documents layer boundary enforcement, forbidden edges, and maintenance guidance.
packages/AGENTS.md	Adds contributor guidance referencing the deny-based enforcement.
packages/udp-server/Cargo.toml	Adds missing version for an internal path dependency (avoid wildcard bans failure).
packages/persistence-benchmark/Cargo.toml	Adds missing version for an internal path dependency (avoid wildcard bans failure).
docs/issues/open/1925-1669-si-31-configure-cargo-deny-for-layer-boundary-enforcement.md	Updates implementation tracking and verification status for the issue spec.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.46%. Comparing base (cefc37f) to head (97b37fb).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #1932      +/-   ##
===========================================
- Coverage    79.49%   79.46%   -0.03%     
===========================================
  Files          324      324              
  Lines        23116    23116              
  Branches     23116    23116              
===========================================
- Hits         18375    18370       -5     
- Misses        4465     4476      +11     
+ Partials       276      270       -6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

[josecelano]

All 7 Copilot review comments have been addressed in commits a478b63c and 97b37fb:

1. multiple-versions rationale — Made self-contained with example crate names
2. protocol comment wording — Tightened to "directly by torrust-tracker-core"
3. --locked flag — Added to copilot-setup-steps.yml install step
4. M4 pending→PASS — Updated in issue spec
5. Stale example config — Updated udp-protocol wrappers to match actual deny.toml
6. Version pin in testing.yaml — Pinned to cargo-deny@0.19.9
7. Version pin in copilot-setup-steps.yml — Pinned to cargo-deny@0.19.9

(These thread IDs don't expose GraphQL node IDs via the REST API, so I can't use the resolve_thread API — but the fixes are pushed to the branch.)

[josecelano]

ACK 97b37fb